MODULES := core/fdt.rad core/platform.rad core/frames.rad core/abi.rad core/handles.rad \

	core/events.rad core/domains.rad

CHECK_MODULES := check/boot.rad check/fixture.rad check/frames.rad check/handles.rad check/domains.rad

record the contracts established through step 5 of the 22-step plan.

## Domain storage and initial authority

- Mechanisms borrow bounded caller-owned storage. Each domain has private

  capability and event-producer state. Lookup accepts only live Pending or

  Active domain identities.

- Zero as a self-sentinel identifies the caller but supplies no resource right.

  Allocate and Create require a live capability to that caller with the right.

  A newly created domain has only its installed Read|Write Events handle.

- Accepting a child reserves one terminal event. At most 128 credits can be

  outstanding in a 256-entry Events queue.

Exercise empty startup authority, self-sentinel checks, bounded domain storage, relationship credits, and identity reuse.

mod domains;

    domains::run();

//! Pending-domain authority and bounded creation checks.

use core::abi;

use core::domains;

use core::handles;

/// Small domain pool used to exercise resource exhaustion.

static DOMAINS: [domains::Domain; 4] = undefined;

/// Require the self sentinel to fail without explicit resource authority.

fn denied(caller: u32) {

    let _object = try domains::authority(&DOMAINS[..], caller, abi::Handle { bits: 0 }, abi::ALLOCATE) catch error {

        assert error == abi::Error::Denied;

        return;

    };

    panic "denied: self sentinel created authority";

}

/// Check initial root rights and the empty authority of pending children.

export fn run() {

    domains::init(&mut DOMAINS[..]);

    let rootHandle = domains::root(&mut DOMAINS[..], 0);

    let root = try! domains::resolve(&DOMAINS[..], 0, rootHandle, abi::CREATE | abi::ALLOCATE);

    let child = try! domains::create(&mut DOMAINS[..], root, 1);

    assert domains::live(&DOMAINS[..], child);

    denied(child.index);

    let queue = try! handles::get(&DOMAINS[child.index].handles, 1, abi::Kind::Events);

    let _events = try! handles::require(&DOMAINS[child.index].handles, queue, abi::Kind::Events, abi::READ | abi::WRITE);

    let _invalid = try handles::get(&DOMAINS[child.index].handles, 0, abi::Kind::Domain) catch error {

        assert error == abi::Error::BadHandle;

        let _second = try! domains::create(&mut DOMAINS[..], root, 1);

        let _third = try! domains::create(&mut DOMAINS[..], root, 1);

        let _fourth = try domains::create(&mut DOMAINS[..], root, 1) catch full {

            assert full == abi::Error::Exhausted;

            return;

        };

        panic "run: exhausted domain pool accepted a child";

    };

    panic "run: child received ambient Domain authority";

}

export mod events;

export mod domains;

//! Domain identities, initial authority, and private startup state.

use core::abi;

use core::events;

use core::handles;

/// Domain state; Dying is an internal quiescence phase.

export union Lifecycle: Copy {

    /// Startup capabilities can be installed before activation.

    Pending,

    /// Authorized execution contexts can run.

    Active,

    /// No execution or handle lookup is permitted.

    Dead,

    /// Contexts must stop before resources can be reclaimed.

    Dying,

}

/// Fixed startup environment; each field occupies eight bytes.

export record Env: Copy {

    /// Readable startup argument range base.

    argsPointer: u64,

    /// Number of argument bytes.

    argsSize: u64,

    /// Packed Events handle in this domain's table.

    eventsHandle: u64,

    /// Physical address of this domain's shared event ring.

    eventsPointer: u64,

    /// Physical base of this image instance's mutable data.

    stateBase: u64,

    /// Lowest address available to this context's stack frames.

    stackBase: u64,

    /// Exclusive upper bound of this context's stack.

    stackTop: u64,

    /// Kernel execution-context identity.

    context: u64,

}

/// One protection domain and its private authority boundary.

export record Domain: Copy {

    /// Domain-relative capability names.

    handles: handles::Table,

    /// Notification storage and private producer state.

    events: events::Queue,

    /// Live incarnation, or zero before the first allocation.

    epoch: u32,

    /// Protection-domain lifecycle.

    state: Lifecycle,

    /// Historical creator identity; independent of the current parent.

    creator: abi::Object,

    /// Current receiver of terminal lifecycle notifications.

    parent: abi::Object,

    /// Trusted immutable image registry index.

    image: u32,

    /// Initial execution environment.

    env: Env,

}

/// Return the identity used for a missing parent or creator.

export fn none() -> abi::Object {

    return abi::Object { kind: abi::Kind::Empty, index: abi::INVALID_DOMAIN, epoch: 0 };

}

/// Initialize caller-owned domain storage once at boot.

export fn init(domains: *mut [Domain]) {

    assert domains.len > 0 and domains.len <= abi::MAX_DOMAINS;

    for i in 0..domains.len {

        let domain = &mut domains[i];

        handles::init(&mut domain.handles);

        events::init(&mut domain.events);

        set domain.epoch = 0;

        set domain.state = Lifecycle::Dead;

        set domain.creator = none();

        set domain.parent = none();

        set domain.image = 0;

        set domain.env = Env {

            argsPointer: 0, argsSize: 0, eventsHandle: 0, eventsPointer: 0,

            stateBase: 0, stackBase: 0, stackTop: 0, context: 0,

        };

    }

}

/// Check that an object identifies a live, non-dying domain incarnation.

export fn live(domains: *[Domain], object: abi::Object) -> bool {

    if object.kind <> abi::Kind::Domain or object.index >= domains.len or object.epoch == 0 {

        return false;

    }

    let domain = &domains[object.index];

    return domain.epoch == object.epoch

        and (domain.state == Lifecycle::Pending or domain.state == Lifecycle::Active);

}

/// Get a live domain identity from a capability with all required rights.

export fn resolve(domains: *[Domain], caller: u32, handle: abi::Handle, rights: u16) -> abi::Object throws (abi::Error) {

    assert caller < domains.len;

    let entry = try handles::require(&domains[caller].handles, handle, abi::Kind::Domain, rights);

    if not live(domains, entry.object) { throw abi::Error::BadHandle; }

    return entry.object;

}

/// Resolve self authority by finding a live capability to the caller.

/// The zero sentinel does not supply Allocate or Create rights itself.

export fn authority(domains: *[Domain], caller: u32, handle: abi::Handle, rights: u16) -> abi::Object throws (abi::Error) {

    if handle.bits <> 0 { return try resolve(domains, caller, handle, rights); }

    let domain = &domains[caller];

    for i in 0..abi::MAX_HANDLES {

        let entry = &domain.handles.entries[i];

        if entry.object.kind == abi::Kind::Domain and entry.object.index == caller

            and entry.object.epoch == domain.epoch and entry.rights & rights == rights {

            return entry.object;

        }

    }

    throw abi::Error::Denied;

}

/// Prepare a free slot with an Events handle and no ambient authority.

fn prepare(domains: *mut [Domain], index: u32, creator: abi::Object, image: u32) -> abi::Object {

    let domain = &mut domains[index];

    assert domain.state == Lifecycle::Dead and domain.epoch < 0xffffffff;

    for i in 0..abi::MAX_HANDLES {

        assert domain.handles.entries[i].object.kind == abi::Kind::Empty;

    }

    set domain.epoch += 1;

    set domain.creator = creator;

    set domain.parent = creator;

    set domain.image = image;

    events::init(&mut domain.events);

    let object = abi::Object { kind: abi::Kind::Domain, index, epoch: domain.epoch };

    let eventObject = abi::Object { kind: abi::Kind::Events, index, epoch: domain.epoch };

    let eventHandle = handles::install(&mut domain.handles, 1, eventObject, abi::READ | abi::WRITE);

    set domain.env = Env {

        argsPointer: 0, argsSize: 0, eventsHandle: eventHandle.bits, eventsPointer: 0,

        stateBase: 0, stackBase: 0, stackTop: 0, context: 0,

    };

    set domain.state = Lifecycle::Pending;

    return object;

}

/// Install root's initial Domain and Events authority into slot zero.

export fn root(domains: *mut [Domain], image: u32) -> abi::Handle {

    assert domains[0].epoch == 0;

    let object = prepare(domains, 0, none(), image);

    return handles::install(&mut domains[0].handles, 0, object, abi::ROOT_RIGHTS);

}

/// Create a pending domain after the caller has authorized image admission.

/// Reserve terminal event capacity before accepting the parent relationship.

export fn create(domains: *mut [Domain], creator: abi::Object, image: u32) -> abi::Object throws (abi::Error) {

    if not live(domains, creator) { throw abi::Error::BadHandle; }

    if domains[creator.index].events.reserved == events::CRITICAL { throw abi::Error::Exhausted; }

    for index in 0..domains.len {

        let domain = &domains[index];

        if domain.state == Lifecycle::Dead and domain.epoch < 0xffffffff

            and domain.handles.entries[1].generation <> 0 {

            let result = prepare(domains, index, creator, image);

            set domains[creator.index].events.reserved += 1;

            return result;

        }

    }

    throw abi::Error::Exhausted;

}

//! Fixed per-domain notification memory and producer state.

/// Shared notification ring depth; a power of two.

export constant CAPACITY: u32 = 256;

/// Notification slots reserved for terminal lifecycle events.

export constant CRITICAL: u32 = 128;

/// A kernel-to-domain asynchronous notification.

export record Event: Copy {

    /// Interrupt=1, Timeout=2, Fault=3, ChildExit=4, Wakeup=5.

    kind: u16,

    /// Reserved ABI field, always zero.

    reserved: u16,

    /// Event-specific token, source, status, or fault code.

    code: u32,

    /// Event-specific payload or sender identifier.

    value: u64,

}

/// Shared ring layout; head and tail require acquire/release access.

export record Ring: Copy {

    /// Notifications indexed by the low bits of head or tail.

    data: [Event; CAPACITY],

    /// Consumer progress, published by serialized user consumers.

    head: u32,

    /// Producer progress, published by the kernel.

    tail: u32,

    /// CAPACITY - 1, supplied by the kernel.

    mask: u32,

}

/// Private kernel state for a domain's ring.

export record Queue: Copy {

    /// Shared ABI storage exposed to this domain.

    ring: Ring,

    /// Last validated consumer progress.

    head: u32,

    /// Authoritative producer progress.

    tail: u32,

    /// Number of outstanding ordinary notifications.

    ordinary: u32,

    /// Live-child and queued-lifecycle delivery reservations.

    reserved: u32,

    /// Slots that release a lifecycle reservation when consumed.

    critical: [bool; CAPACITY],

}

/// Clear event memory before it is exposed to a domain incarnation.

export fn init(queue: *mut Queue) {

    for i in 0..CAPACITY {

        set queue.ring.data[i] = Event { kind: 0, reserved: 0, code: 0, value: 0 };

        set queue.critical[i] = false;

    }

    set queue.ring.head = 0;

    set queue.ring.tail = 0;

    set queue.ring.mask = CAPACITY - 1;

    set queue.head = 0;

    set queue.tail = 0;

    set queue.ordinary = 0;

    set queue.reserved = 0;

}